Under GDPR, is a controller generally permitted to switch from one lawful basis to another after processing has already begun?
